Privacy Policy

Last updated: July 14, 2026

Summary: Simple Authenticator stores your 2FA account secrets on your device. Login is optional. If you enable cloud backup, only ciphertext encrypted with your sync passphrase is stored in the cloud — we cannot read your codes. The free app may show ads via Google AdMob.

1. What this app is

Simple Authenticator is a TOTP/HOTP authenticator (two-factor verification codes). It is not a password manager and does not store website passwords or login vaults.

2. Data we store on your device

Accounts you add (issuer, account name, OTP secret, algorithm settings) are stored locally using platform secure storage (e.g. Android Keystore / iOS Keychain via the app’s secure storage layer).

Optional local settings may include PIN lock preference, biometric unlock preference, auto-lock timeout, and whether you skipped sign-in.

OTP codes are generated on-device from your secrets. They are not sent to a server as part of normal code display.

3. Optional account & cloud backup

You may use the app without signing in (“Skip for now”). If you choose to sign in:

Google Sign-In uses Firebase Authentication. Google provides basic account identifiers (such as user ID, email, and display name) needed for the session.
Cloud backup stores an encrypted backup of your OTP accounts in Firebase/Firestore under your user account. Encryption is performed on-device with a sync passphrase you choose (AES-256-GCM; key derived with PBKDF2-HMAC-SHA256). The cloud stores ciphertext, nonce, salt, and related metadata — not plaintext secrets.
If you forget the sync passphrase, cloud backup cannot be recovered by us or anyone else.

Passkey sign-in (where available) is an alternate way to authenticate to the app’s cloud identity, not a vault of website passkeys.

4. Local security features

Optional PIN, biometric unlock, and auto-lock protect access to the app on your device. Biometric data stays on the device and is handled by the operating system.

5. Export / import

Encrypted file export/import uses a separate file passphrase you choose. Exported files leave the app only when you share or save them through the system share sheet or file picker.

You can also import accounts from Google Authenticator migration QR codes or related import flows you initiate.

6. Advertising

The app may display banner ads using Google Mobile Ads (AdMob). Ad networks may collect device and usage signals according to Google’s advertising policies and your OS-level privacy settings (for example App Tracking Transparency on iOS, or Google Play advertising ID controls on Android).

7. Third-party services

Firebase Auth, Cloud Firestore, Cloud Functions — account session and optional encrypted backup / related auth helpers
Google Sign-In — optional authentication
Google Mobile Ads — optional advertising

These providers process data under their own privacy policies when you use features that depend on them.

8. What we do not do

We do not operate a password manager or breach-scanning service in this app
We do not use iCloud / CloudKit for vault sync
We cannot decrypt your cloud backup without your sync passphrase

9. Your choices

Stay offline: skip sign-in; data remains local only
Enable backup: sign in and set a strong sync passphrase
Delete local data: clear app data or uninstall
Delete cloud identity / backup: sign in and remove the account/backup through the app flows available, or contact support if needed

10. Policy changes

Material changes may be reflected in app or website updates. Continued use after an update means you accept the revised policy.

11. Contact

Questions? Visit our Support page.